697 matches found
PT-2022-28048 · Unknown · Usememos/Memos
Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue concerns the exposure of sensitive user information, including names, email, role, and OpenID, to an authenticated user. This is due to improper removal of sensitive information...
CVE-2022-4734 Improper Removal of Sensitive Information Before Storage or Transfer in usememos/memos
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1...
CVE-2022-4692
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...
Stored XSS in memos while creating
Description After login create a new memo with the following XSS payload " and click save that will make alert Proof of Concept "...
Archive any private memos + Delete any Shortcut + Edit any Shortcut from other users
Description User can archive any private memos, Delete any Shortcut and Edit any Shortcut from other users via api PATCH /api/memo/8 HTTP/1.1 "id":8,"rowStatus":"ARCHIVED" PATCH /api/shortcut/2 HTTP/1.1 "id":2,"title":"shortahihix","payload":"" DELETE /api/shortcut/2 Proof of Concept Login to...
View any content private memos from other users
Description User can view any content from private private memos from other users via api PATCH /api/memo/8 HTTP/1.1 "id":8,"rowStatus":"ARCHIVED" Proof of Concept Login to website in brower 1 with user A. Login to website in brower 2 with user B. Example: User B have private nemo with id 8. With...
usememos/memos vulnerable to stored cross-site scripting (XSS)
usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 has a feature to upload file and display it, and by uploading a crafted SVG file, an attacker could perform a stored cross-site scripting attack with the image direct link. Thi...
usememos/memos vulnerable to account takeover due to improper access control
usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Versions prior to 0.9.0 improperly maintain access control allowing an attacker to take over an account by changing header values in the HTTP request...
usememos/memos vulnerable to improper authorization
usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos versions prior to 0.9.0 are vulnerable to improper authorization, which can allow a user to modify the nickname, username and email of other users without permission...
GHSA-FV6C-RFG3-GVJW usememos/memos makes Incorrect Use of Privileged APIs
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0...
usememos/memos makes Incorrect Use of Privileged APIs
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0...
usememos/memos missing Secure cookie attribute
usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 is missing the Secure cookie attribute, making it vulnerable to session hijacking...
GHSA-QCW2-492V-57XJ usememos/memos missing Secure cookie attribute
usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 is missing the Secure cookie attribute, making it vulnerable to session hijacking...
GHSA-C8JH-VCJH-FX2W usememos/memos vulnerable to stored cross-site scripting (XSS)
usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 has a feature to upload file and display it, and by uploading a crafted SVG file, an attacker could perform a stored cross-site scripting attack with the image direct link. Thi...
usememos/memos Authorization Bypass Through User-Controlled Key vulnerability
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0...
CVE-2022-4690
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...
CVE-2022-4689
Improper Access Control in GitHub repository usememos/memos prior to 0.9.0...
CVE-2022-4688
Improper Authorization in GitHub repository usememos/memos prior to 0.9.0...
